CodeSmith — senior engineering agent configuration. Full-stack dev automation, CI/CD pipelines, GitHub workflows, ACP dispatch patterns, and real operational...

This package appears to be a legitimate mentoring/automation configuration for coding agents, but it under-declares important operational requirements. Before applying: - Do not assume the registry metadata lists everything: the docs expect the 'gh' CLI, ACP enabled, and tokens like VERCEL_TOKEN for API deploys. Provide those only if you understand the risk. - Back up ~/.openclaw/workspace/AGENTS.md and ~/.openclaw/cron/jobs.json (the package itself recommends this). Validate diffs before accepting any changes. - Start with the recommended gradual rollout: enable only the morning brief cron first and verify outputs, then add others one at a time. - Confirm how your platform supplies channel delivery credentials; verify the skill will not be able to post to external channels without your explicit config. - Test LOCKDOWN.md behavior on a safe dev agent: create the LOCKDOWN file and confirm scheduled sessions halt and post the expected message. - Review any example curl/command snippets before running them: they reference environment variables (e.g., $VERCEL_TOKEN) that you must provision securely; avoid pasting tokens into chat or unreviewed scripts. - If you want stronger assurances, ask the publisher (or inspect the package source repository) for a declared list of required env vars and an explicit checklist of what gets written during setup. Confidence note: high confidence this package is coherent with its stated purpose, but suspicious because of the mismatch between declared requirements and the actual runtime guidance (credentials, binaries, cron/network interactions).

Type: OpenClaw Skill Name: codesmith Version: 1.0.0 The CodeSmith bundle is a highly professional and security-conscious configuration for a coding automation agent. It features a robust 'LOCKDOWN' safety protocol, explicit instructions to treat external content as data to prevent prompt injection (AGENTS.md), and transparent documentation of operational risks through 'Failure Stories' (working-patterns.md). While it enables high-autonomy features such as scheduled overnight work and GitHub/Vercel integration (cron-patterns.json), these capabilities are strictly governed by instructions to use feature branches, avoid production deployments, and never log credentials, showing clear alignment with its stated purpose without malicious intent.